{"id":"CVE-2022-2356","aliases":["EUVD-2022-34624","GHSA-r7g6-6vgc-xh4c"],"status":"published","title":"User Private Files \u003c 1.1.3 - Subscriber+ Arbitrary File Upload","description":"The Frontend File Manager \u0026 Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00992,"percentile":0.62828,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-434"],"published":"2022-08-08T13:46:51Z","modified":"2026-06-23T16:16:57Z","products":[{"vendor":"mediajedi","product":"user_private_files"},{"vendor":"unknown","product":"frontend file manager \u0026 sharing – user private files"}],"references":[{"url":"https://wpscan.com/vulnerability/67f3948e-27d4-47a8-8572-616143b9cf43","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://wpscan.com/vulnerability/67f3948e-27d4-47a8-8572-616143b9cf43/","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2356"},{"url":"https://github.com/advisories/GHSA-r7g6-6vgc-xh4c"}],"sources":{"cve":[{"id":"CVE-2022-2356","title":"User Private Files \u003c 1.1.3 - Subscriber+ Arbitrary File Upload","description":"The Frontend File Manager \u0026 Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded.","status":"published","published":"2022-08-08T13:46:51Z","modified":"2026-06-23T14:39:37.731Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:34:32.843656Z"}],"euvd":[{"id":"EUVD-2022-34624","description":"The Frontend File Manager \u0026 Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded.","status":"published","published":"2022-08-08T13:46:51Z","modified":"2026-06-23T14:39:37Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:33.324654Z"}],"ghsa":[{"id":"GHSA-r7g6-6vgc-xh4c","title":"The Frontend File Manager \u0026 Sharing WordPress plugin before 1.1.3 does not filter file extensions...","description":"The Frontend File Manager \u0026 Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded.","status":"published","published":"2022-08-09T00:00:24Z","modified":"2023-02-01T05:02:19Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:49:53.323636Z"}],"nvd":[{"id":"CVE-2022-2356","description":"The Frontend File Manager \u0026 Sharing WordPress plugin before 1.1.3 does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded.","status":"published","published":"2022-08-08T14:15:08.807Z","modified":"2026-06-23T16:16:57.643Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:07:24.39467Z"}]}}